Confusing management of user access to collections

Whereas I love the new edition of Specify7 and user management appearing to be really powerful now, I’m stuck waddling about a simple task: Adding an existing user to another collection.

For instance: I have a user, Tom Schiøtte, which has been connected to the “Invertebrate Zoology” collection in Specify for a very long time. This user needs to be added to a newly created collection called “Exhibitions”. So I log on with my admin access and head to the Security and Accounts section.

First I try to look up the user at the institution level. His username is “schioette”. I then select the collection “NHMD Exhibitions” from the dropdownlist and tick off “Enable Collection Access” and “Full Access - Legacy” (He’s marked “Collection Admin” for InvZool).

Assuming an agent needs to be assigned to this user for this particular collection/discipline, I also add that, believing all should be OK then.

image

I move down to hit “Save”:

image

But then, for some reason, Specify7 demands that I also set agents for all other collections, even though these are not relevant at all.

Why is that???

Hi @fedoras,

If that user is set as a Specify 6 Admin, that automatically grants collection access to all Specify collections for that application.

To achieve a similar effect, you can remove the Admin status in Specify 6 permissions, you can set the collection individually and change the User Group to “Manager”.

1 Like

That is not the case, unfortunately.

Hi @fedoras,

Is it the case that you established collection access for this user under the Institution header?

This could also give collection accesss to all collections.

Yes. How would we go about changing that, so access is restricted to the collections relevant for this person?

By checking the Collection Access checkbox under the Collection heading individually you will not need to grant collection access at the Institution level.

Unfortunately, this is not the answer. I understand my colleague @ZsPapp has been writing extensively with you on this issue and she’s in a bit of a pickle. Actually we all are, since we need to introduce a host of new end users to the platform and this gives it a bad rep. I hope you can help her get to the bottom of this soon.

1 Like

Unfortunately, this is not the answer. I understand my colleague @ZsPapp has been writing extensively with you on this issue and she’s in a bit of a pickle. Actually we all are, since we need to introduce a host of new end users to the platform and this gives it a bad rep. I hope you can help her get to the bottom of this soon.

I have worked with @ZsPapp to find a solution in the meantime for this issue. We have created placeholder agents in each division so that permissions can be changed and applied to existing Specify users without any issues!

From what I can tell, it looks like the issue @ZsPapp was encountering was related to existing users when their permissions were changed. As for new users, you need to first create an agent for them in the desired divisions and then a new user account can be made and assigned to that agent.

We have pushed a fix in the next release (arriving next week) to allow the creation of agents from the query combo box in the Security & Accounts panel!

2 Likes

Yes, finally everything works as they should do!

Existing users can have updated permissions now to the different divisions, and new users can be assigned to an agent as well.

It gave us some headache, but finally a working solution was found, thank you for investigating the case, @Grant!

I just wanted to change someone’s password… What do I do now?

And when I create distinct agents for this user in each division I get this:


It appears that all agents are added to the same division instead of each individual one…

That is clearly a bug, since I’m using the + button for each separate division in this very interface!

Hi @fedoras,

We have pushed a fix for this issue in our latest version of Specify 7, but for now, you can work around this by creating an agent in each of those divisions (at the database level or through Specify) and assigning those temporarily.

It looks like the Placeholder agent was assigned to someone who has permission in those divisions, so now they are being used.

1 Like